Generated file — do not edit by hand. Produced by
tooling/gen-graphql-ref.pyfrom the OSYRA edge GraphQL SDL.
Mutations
108 operation(s).
acceptOrgOwnershipTransfer
acceptOrgOwnershipTransfer(input: AcceptOrgOwnershipTransferInput!): OrgOwnershipTransferResult!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | AcceptOrgOwnershipTransferInput! | | |
Returns: OrgOwnershipTransferResult!
addPaymentMethod
addPaymentMethod(input: AddPaymentMethodInput!): PaymentMethod!Add a new payment method Requires: billing:write permission
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | AddPaymentMethodInput! | | |
Returns: PaymentMethod!
approveContentBoundEnablement
approveContentBoundEnablement(input: ApproveContentBoundEnablementInput!): ContentBoundEnablement!CHECKER: approve a PENDING enablement (-> ACTIVE) with a step-up bound to enablementId. IAM identity-enforces checker != maker and re-checks all six gates.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ApproveContentBoundEnablementInput! | | |
Returns: ContentBoundEnablement!
approvePrivateEndpoint
approvePrivateEndpoint(id: ID!): PrivateEndpoint!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: PrivateEndpoint!
attachLitigationHold
attachLitigationHold(input: LitigationHoldInput!): LitigationHoldReceipt!Place a litigation hold over a range for the caller's workspace (ADR-123 D8).
ADMIN-CLASS: requires the audit:legal-hold JWT scope (enforced edge-side
BEFORE the RPC AND re-checked server-side by AP00005 + an AP00009 admin
assertion). Freezes retention; both place + release are CRITICAL self-audit
events. NEVER rely on the UI gate alone.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | LitigationHoldInput! | | |
Returns: LitigationHoldReceipt!
auditExport
auditExport(input: AuditExportInput!): AuditExportReceipt!Request a signed .audit.zip export for the caller's workspace over a time
range (ADR-123 D5). Requires the audit:export JWT scope (enforced
edge-side BEFORE the RPC AND re-checked server-side by AP00005). Returns the
presigned-URL receipt; the client downloads + verifies offline. NO STUBS.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | AuditExportInput! | | |
Returns: AuditExportReceipt!
cancelBillingSubscription
cancelBillingSubscription(organizationId: ID!, reason: String): BillingSubscription!Cancel subscription Requires: billing:admin permission
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| organizationId | ID! | | |
| reason | String | | |
Returns: BillingSubscription!
cancelEmailChange
cancelEmailChange(input: CancelEmailChangeInput!): EmailChangeResult!Cancel ("wasn't me") an in-flight email change with the single-use revoke token from the OLD-address email (token-authenticated; no step-up). Idempotent and neutral; every failure folds to the same uniform error as confirm.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | CancelEmailChangeInput! | | |
Returns: EmailChangeResult!
changePassword
changePassword(input: ChangePasswordInput!): Boolean!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ChangePasswordInput! | | |
Returns: Boolean!
chatCompletion
chatCompletion(input: ChatCompletionInput!): ChatCompletionResponse!Create a chat completion Calls Model Broker via gRPC
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ChatCompletionInput! | | |
Returns: ChatCompletionResponse!
checkDomainVerification
checkDomainVerification(domain: String!, verificationToken: String): DomainVerification!Poll / advance the R5 state machine for domain. A PENDING DNS-TXT challenge is
re-checked against DNS; when verificationToken (delivered to the role email) is
supplied it is consumed to prove a role-email challenge. Modeled as a MUTATION
because it advances the state machine (and consumes the single-use email token).
It returns the current status only — it never re-exposes the DNS record or role
email (requestDomainVerification is the sole issuer of those).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| domain | String! | | |
| verificationToken | String | | |
Returns: DomainVerification!
claimVanitySlug
claimVanitySlug(slug: String!): Organization!ADR-368 §7.6 vanity/brand-handle claim: set the org's slug to a GATE / bare-brand skeleton, gated (in IAM) on the org holding a VERIFIED domain whose registrable label matches the slug (R5). A BLOCK skeleton is never claimable. Returns the updated organization.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| slug | String! | | |
Returns: Organization!
clearOcarTrustConfig
clearOcarTrustConfig(input: ClearOcarTrustConfigInput!): OcarTrustConfig!CLEAR the workspace OCAR config (CAS on expectedVersion). A WEAKENING op — lands pending=true awaiting a DISTINCT 2nd admin's promote (ADR-337 §D7). Same authz + JWT-derived-ws invariants.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ClearOcarTrustConfigInput! | | |
Returns: OcarTrustConfig!
clearWorkspaceDefaultProvider
clearWorkspaceDefaultProvider(workspaceId: ID!, model: String!): Boolean!Close the open declaration for (workspace, model). Idempotent: false when no open declaration existed. Requires: osyra:billing:*:write.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| model | String! | | |
| workspaceId | ID! | | |
Returns: Boolean!
commitApiKeyBulkRevocation
commitApiKeyBulkRevocation(input: CommitApiKeyBulkRevocationInput!): ApiKeyBulkRevocationResult!Commits the exact preview under action-specific step-up and the request's Idempotency-Key. IAM re-authorizes and re-counts while holding the target revocation fence before changing any credential.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | CommitApiKeyBulkRevocationInput! | | |
Returns: ApiKeyBulkRevocationResult!
compileBundle
compileBundle(scope: ScopeInput!, policyId: String!): BundleManifest!Compile + sign + store a bundle for a policy, returning the signed manifest. Requires the same admin role. For a workspace scope the owning-org parent layer is bound server-side (derived from the JWT, never from input).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| policyId | String! | | |
| scope | ScopeInput! | | |
Returns: BundleManifest!
confirmEmailChange
confirmEmailChange(input: ConfirmEmailChangeInput!): EmailChangeResult!Confirm an email change with the single-use token from the NEW-address email (the token IS the credential — no RequireAuth / step-up). The ATOMIC switch happens in IAM. Every failure (invalid / expired / already-used / wrong-state) folds to ONE uniform error — no token-state oracle.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ConfirmEmailChangeInput! | | |
Returns: EmailChangeResult!
connectProvider
connectProvider(input: ConnectProviderInput!): IssueVirtualKeyPayload!Self-service BYOK connect-provider (ADR-361 / ENG-3036). Pastes a RAW provider key ([SECRET], write-only, never logged), which IAM's ConnectProvider RPC vaults (OSYRA_MANAGED) + issues a virtual key over. Reuses the IssueVirtualKeyPayload shape — the FULL bearer alias PLAINTEXT, returned ONCE. OSY-VK-NOT-WIRED until the IAM RPC is reachable (never a fabricated key).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ConnectProviderInput! | | |
Returns: IssueVirtualKeyPayload!
createApiKey
createApiKey(input: CreateApiKeyInput!): CreateApiKeyResult!Mint a new key. SANDBOX atomically replaces the user's prior active key; revoke permits immediate replacement. Its 24h value is credential lifetime, not a mint cooldown. Replacement never resets the identity-scoped request budget enforced on the serving path.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | CreateApiKeyInput! | | |
Returns: CreateApiKeyResult!
createBillingPortalSession
createBillingPortalSession(returnUrl: String!): BillingPortalSession!Create a single-use Stripe Customer Portal session for the caller's org. Returns a short-lived URL (~5 min) that the frontend redirects to for invoice viewing, payment method management, and (non-enterprise tiers) self-service subscription cancellation. Org is taken from the JWT — never from a request field — to prevent IDOR. Requires: authenticated user with org_id claim. ENG-455.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| returnUrl | String! | | |
Returns: BillingPortalSession!
createBudget
createBudget(scopeType: BudgetScope!, scopeId: String!, usdCeilingCents: String!, mode: BudgetMode!, alertThresholdPcts: [Int!]): Budget!Create a spend budget for a scope (one active budget per org/scope). usdCeilingCents is an exact integer-cents string (converted to micro-cents server-side). Requires: osyra:billing:*:write (backend BILLING_ROLES-gated + audit-logged).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| alertThresholdPcts | [Int!] | | |
| mode | BudgetMode! | | |
| scopeId | String! | | |
| scopeType | BudgetScope! | | |
| usdCeilingCents | String! | | |
Returns: Budget!
createCheckoutSession
createCheckoutSession(input: CreateCheckoutSessionInput!): CheckoutSession!Create a Stripe Checkout session for a plan upgrade (the "Upgrade to PRO" button). Returns the Stripe-hosted checkout URL the frontend redirects to. Org is taken from the JWT — never from a request field — to prevent IDOR. planCode maps to a Stripe Price via AP00003 config (NOT a pricing decision here; ENG-755 pricing is already ratified). successUrl/cancelUrl are host-allowlist validated to block open redirects. Requires: authenticated user with org_id claim. ENG-2659 (backend ENG-219).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | CreateCheckoutSessionInput! | | |
Returns: CheckoutSession!
createEventSubscription
createEventSubscription(input: CreateEventSubscriptionInput!): EventSubscription!Register an outbound governance-event destination for the caller's org. eventTypes is a non-empty subset of the closed wire set ("budget-exceeded" | "guardrail-triggered" | "request-failed" | "test"). Invalid URLs / transports / event types are rejected by billing (INVALID_ARGUMENT → OSY-VALID-4001), including SSRF-denied destinations.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | CreateEventSubscriptionInput! | | |
Returns: EventSubscription!
createOrganization
createOrganization(input: CreateOrganizationInput!): Organization!Organization management
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | CreateOrganizationInput! | | |
Returns: Organization!
createPolicy
createPolicy(scope: ScopeInput!, sourceFormat: PolicySourceFormat!, source: String!): Policy!Author a new policy source document at the JWT-derived scope. Requires WORKSPACE_ADMIN (workspace) / ORG_ADMIN (org) or SUPER_ADMIN.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| scope | ScopeInput! | | |
| source | String! | | |
| sourceFormat | PolicySourceFormat! | | |
Returns: Policy!
createWarehouseDestination
createWarehouseDestination(input: CreateWarehouseDestinationInput!): WarehouseDestination!Register a new warehouse destination under the JWT-derived tenant + MINT its per-destination STS ExternalId (CreateWarehouseDestination). ADMIN-CLASS write: gated on warehouseScopeAdmin BEFORE the RPC (the egress config governs where signed evidence flows), AND re-checked server-side. A malformed config → validation error; a BigQuery create (deferred WIF seam) → a precondition error; an unwired backend → OSY-WAREHOUSE-NOT-WIRED — never a fabricated destination or ExternalId.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | CreateWarehouseDestinationInput! | | |
Returns: WarehouseDestination!
createWorkspace
createWorkspace(input: CreateWorkspaceInput!): Workspace!Workspace management
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | CreateWorkspaceInput! | | |
Returns: Workspace!
cuaReDecide
cuaReDecide(receiptId: String!): CuaReDecision!Re-decide ONE pinned cua-action receipt (ENG-2462 replay engine; ADR-230 D4): re-run the AP00019 policy over the pinned receipt body and verify the append-only chain link, returning whether the re-decided verdict reproduces the recorded one (no drift). Idempotent — it re-computes over pinned inputs and changes no state; modeled as a mutation for the on-demand, button-triggered invocation UX. Fail-closed: a receipt that does not decode / verify, or a wrong pinned bundle, is a gRPC error, never a fabricated verdict.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| receiptId | String! | | |
Returns: CuaReDecision!
decideWorkflowApproval
decideWorkflowApproval(input: WorkflowApprovalDecisionInput!): WorkflowSignalResult!Approve or reject a pending HITL gate (SignalWorkflow signal_name="approval").
Requires the workflow:approve JWT scope (enforced edge-side BEFORE the RPC AND
re-checked server-side by AP00007). Returns OSY-WORKFLOW-NOT-WIRED until
WORKFLOW_SERVICE_ADDR is configured (NO STUBS — never a fabricated decision).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | WorkflowApprovalDecisionInput! | | |
Returns: WorkflowSignalResult!
deleteBudget
deleteBudget(id: ID!): Boolean!Hard-delete a budget (its spend + alert children CASCADE). Requires: osyra:billing:*:write.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: Boolean!
deleteOrganization
deleteOrganization(id: ID!): Boolean!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: Boolean!
deleteWarehouseDestination
deleteWarehouseDestination(destinationId: ID!): WarehouseDeleteResult!Remove a destination from the registry (DeleteWarehouseDestination). ADMIN-CLASS write (gated on warehouseScopeAdmin). Idempotent: deleted=false when the id is not visible under the bound tenant. Fails closed to OSY-WAREHOUSE-NOT-WIRED when unwired.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| destinationId | ID! | | |
Returns: WarehouseDeleteResult!
deleteWorkspace
deleteWorkspace(id: ID!): Boolean!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: Boolean!
disableMfa
disableMfa: Boolean!Returns: Boolean!
downloadMlBom
downloadMlBom(input: MlBomDownloadInput!): MlBomDownload!Project a VERIFIED oadr.v1 admission envelope into its regulator-shaped CycloneDX-1.7 ML-BOM for download (ENG-2583 / ADR-269 D1). AP00016 re-decides the envelope (verify) and projects ONLY an oadr.v1 receipt that VERIFIES; the workspace is JWT-derived (NEVER input) and stamped onto the AP00016 GetMlBom req.Ws — AP00016 rejects unless it equals the signed workspace claim (cross-tenant → fail-closed empty BOM). This is the live data path for the FE supply-chain ML-BOM download (the FallbackBanner is dropped on this path once VIR_SERVICE_ADDR is wired). FAIL-CLOSED: an unreachable verifier surfaces as an error; a verify/projection failure surfaces as accepted=false + null mlBomB64 + the reason — NEVER a fabricated regulator artifact.
It is a mutation (not a query) for the SAME reason as verifyOadrAdmission: AP00016 burns the envelope's single-use eat_nonce within the workspace during the re-decision — it is NOT a side-effect-free read.
Returns OSY-OADR-NOT-WIRED until VIR_SERVICE_ADDR is configured (dev path).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | MlBomDownloadInput! | | |
Returns: MlBomDownload!
embedding
embedding(input: EmbeddingInput!): EmbeddingResponse!Create embeddings for text
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | EmbeddingInput! | | |
Returns: EmbeddingResponse!
enableMfa
enableMfa(input: EnableMfaInput!): MfaEnrollment!MFA
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | EnableMfaInput! | | |
Returns: MfaEnrollment!
executeErasure
executeErasure(input: ExecuteErasureInput!): ErasureFulfilmentExecute the Art-17 destructive erasure fan-out (ExecuteErasure) → the EFR projection. The CHECKER identity is server-derived from the JWT subject (AP00005 enforces maker != checker). ENG-2998: the input carries the AP00009 dual-control approval envelope AP00005 verifies fail-closed BEFORE any fan-out. HONESTLY FAILS CLOSED: a missing/invalid/stale approval + the surface-erase / mint seams surface as a client-actionable validation error (identity-proofing / distinct-approver / valid fresh approval / not-yet-enabled surface required); an unknown / cross-tenant dsarId → null; an unwired backend → OSY-EUCOMPLIANCE-NOT-WIRED — never a fabricated or phantom erasure.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ExecuteErasureInput! | | |
Returns: ErasureFulfilment
exportMemoryArchive
exportMemoryArchive(input: ExportMemoryArchiveInput!): ExportMemoryArchivePayload!Export the caller's workspace memory as a signed OMP archive. Workspace + signing key are server-authoritative (JWT-derived; never input).
ExportArchive is UNIMPLEMENTED on the OME server today — the edge maps the gRPC Unimplemented status to a clean OSY-SERVER-9050 GraphQL error (never a panic / fabricated archive). NO STUBS.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ExportMemoryArchiveInput! | | |
Returns: ExportMemoryArchivePayload!
gatedMemoryRead
gatedMemoryRead(input: GatedMemoryReadInput!): GatedMemoryReadPayload!Read a value through the attested-memory READ-gate (cap ∧ policy ∧ attestation).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | GatedMemoryReadInput! | | |
Returns: GatedMemoryReadPayload!
gatedMemoryWrite
gatedMemoryWrite(input: GatedMemoryWriteInput!): GatedMemoryWritePayload!Commit a value through the attested-memory WRITE-gate. The workspace is derived from the caller's JWT (server-authoritative, never input); the edge presents its mTLS identity to OME. Records an amgate_decisions row (admit or deny).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | GatedMemoryWriteInput! | | |
Returns: GatedMemoryWritePayload!
getUsageExportUrl
getUsageExportUrl(workspaceId: ID, startIso: String!, endIso: String!): UsageExportUrl!ENG-2074: build a daily-aggregated usage CSV (date, workspace, requests, tokens — NO cost) over [startIso, endIso) and return a short-TTL pre-signed download URL. Org is taken from the JWT — never a request field — to prevent IDOR; a caller-supplied workspaceId must match the JWT workspace. Gated on the osyra:billing:usage-export scope and per-workspace rate-limited.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| endIso | String! | | |
| startIso | String! | | |
| workspaceId | ID | | |
Returns: UsageExportUrl!
importMemoryArchive
importMemoryArchive(input: ImportMemoryArchiveInput!): ImportMemoryArchivePayload!Verify-admit a signed OMP archive into the caller's (empty) workspace. A non-empty target is REFUSED (admitted=false, errorCode OSY-MEM-5254); use mergeMemoryArchives for a verified union into a non-empty workspace.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ImportMemoryArchiveInput! | | |
Returns: ImportMemoryArchivePayload!
initiateEmailChange
initiateEmailChange(input: InitiateEmailChangeInput!): EmailChangeResult!============================================================================ Email change (Wave 3 — ENG-2729 / ADR-314 §2) An initiate/confirm pair (pure request/response, no redirect leg → GraphQL is the correct surface; this is NOT a one-shot {newEmail}->Boolean switch).
Begin an email change. AUTHENTICATED + STEP-UP gated: present a single-use,
short-TTL, operation-bound step-up token (scope=CHANGE_EMAIL) in the
X-Osyra-Step-Up-Token header — IAM verifies+consumes it and cross-checks its
subject == caller (ENG-2664) before the change starts. The user_id is the JWT
principal, NEVER input (ENG-1937). Enumeration-neutral: success is identical
whether or not newEmail already exists — IAM sends a confirm link to the NEW
address and a "wasn't me" revoke link to the OLD one and never reveals existence.
The email is NOT switched here.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | InitiateEmailChangeInput! | | |
Returns: EmailChangeResult!
inviteMember
inviteMember(input: InviteMemberInput!): Invitation!Member management
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | InviteMemberInput! | | |
Returns: Invitation!
issueContentBoundEnablement
issueContentBoundEnablement(input: IssueContentBoundEnablementInput!): ContentBoundEnablement!MAKER: request a CONTENT_BOUND enablement for the caller's JWT workspace (status -> PENDING).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | IssueContentBoundEnablementInput! | | |
Returns: ContentBoundEnablement!
issueStepUpToken
issueStepUpToken(input: IssueStepUpTokenInput!): StepUpToken!============================================================================ Step-up re-auth (ENG-617) Issues a short-lived, scope-bound, single-use JWT after the caller re-verifies a credential (password OR TOTP/backup code). The token is presented as the X-Osyra-Step-Up-Token header on the specific sensitive mutation it is bound to. Rate limited 5/min/user. Caller must be authenticated.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | IssueStepUpTokenInput! | | |
Returns: StepUpToken!
issueVirtualKey
issueVirtualKey(input: IssueVirtualKeyInput!): IssueVirtualKeyPayload!Mint a virtual key. The response carries the FULL bearer alias PLAINTEXT, returned ONCE.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | IssueVirtualKeyInput! | | |
Returns: IssueVirtualKeyPayload!
mergeMemoryArchives
mergeMemoryArchives(input: MergeMemoryArchivesInput!): MergeMemoryArchivesPayload!Merge ≥2 signed OMP archives into the caller's workspace under a verified union; emits the merged archive, the EAT Merge Receipt, the merge root, and the surfaced-contradiction audit set.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | MergeMemoryArchivesInput! | | |
Returns: MergeMemoryArchivesPayload!
openDsarRequest
openDsarRequest(input: OpenDsarInput!): DsarRequest!Open a new data-subject request under the JWT-derived tenant (OpenDsarRequest); returns the persisted OPEN row. The MAKER identity is server-derived from the JWT subject (never a client field). Fails closed to OSY-EUCOMPLIANCE-NOT-WIRED when unwired; a malformed / unresolved subject is a validation error — never a fabricated row.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | OpenDsarInput! | | |
Returns: DsarRequest!
promoteOcarTrustConfig
promoteOcarTrustConfig(input: PromoteOcarTrustConfigInput!): OcarTrustConfig!APPROVE (as the DISTINCT 2nd admin) the single outstanding PENDING weakening op (ADR-337 §D7). The approver is JWT-derived and MUST differ from the maker (AP00016 7727). Same authz.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | PromoteOcarTrustConfigInput! | | |
Returns: OcarTrustConfig!
publishBundle
publishBundle(scope: ScopeInput!, bundleVersion: Int!): PublishReceipt!Activate a compiled bundle version at the JWT-derived scope. Requires the same admin role. Platform publish is NOT exposed.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| bundleVersion | Int! | | |
| scope | ScopeInput! | | |
Returns: PublishReceipt!
publishDeployment
publishDeployment(input: PublishDeploymentInput!): PromptDeployment!Sign + atomically insert a prompt.deployment.v1 pointer claim activating targetCid in the environment (intent pinned to "publish"). JWT-derived workspace; returns the REAL inserted pointer — or an error (NO STUBS).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | PublishDeploymentInput! | | |
Returns: PromptDeployment!
reactivateBillingSubscription
reactivateBillingSubscription(organizationId: ID!): BillingSubscription!Reactivate a subscription that is scheduled for cancellation (ENG-3050). Undoes cancelBillingSubscription BEFORE the period ends: AP00003-billing's ReactivateSubscription RPC clears cancel_at_period_end (server-side IDOR gate + state machine — reactivating a non-scheduled subscription is a typed error, never a silent no-op). organizationId must match the caller's JWT org — the edge rejects a foreign org before the RPC (mirrors cancelBillingSubscription). Requires: billing:admin permission
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| organizationId | ID! | | |
Returns: BillingSubscription!
recordDsarVerification
recordDsarVerification(input: RecordDsarVerificationInput!): DsarRequestRecord the subject identity-proofing on a DSAR request (ENG-3041 — RecordDsarVerification) → the updated request row (verificationMethod + verifiedAt now set). This is the leg that makes a DSAR COMPLETABLE: AP00005 gates the Art-17 executeErasure AND the Art-15 requestSubjectAccessExport on a recorded proofing (else they fail closed forever with "must proof first"). ADMIN-CLASS write: gated on dsarScopeWrite BEFORE the RPC (recording who a subject IS is never an arbitrary-member action), AND re-checked server-side by AP00005. The VERIFIER identity is server-derived from the JWT subject (never a client field). An unknown / cross-tenant dsarId → null; a malformed method / proof ref → a client-actionable validation error; an unwired backend → OSY-EUCOMPLIANCE-NOT-WIRED — never a fabricated proofing.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | RecordDsarVerificationInput! | | |
Returns: DsarRequest
registerPrivateEndpoint
registerPrivateEndpoint(input: RegisterPrivateEndpointInput!): PrivateEndpoint!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | RegisterPrivateEndpointInput! | | |
Returns: PrivateEndpoint!
releaseLitigationHold
releaseLitigationHold(input: LitigationHoldReleaseInput!): LitigationHoldReceipt!Release (lift) a previously-placed litigation hold for the caller's workspace
(ADR-123 D8). ADMIN-CLASS: requires the audit:legal-hold JWT scope (enforced
edge-side BEFORE the RPC AND re-checked server-side by AP00005 + an AP00009
admin assertion), and AP00005 REQUIRES a non-empty counsel release reference.
Re-arms the retention clock; both place + release are CRITICAL self-audit
events. Returns the updated receipt (status released). NEVER rely on the UI
gate alone.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | LitigationHoldReleaseInput! | | |
Returns: LitigationHoldReceipt!
removeMember
removeMember(organizationId: ID!, userId: ID!): Boolean!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| organizationId | ID! | | |
| userId | ID! | | |
Returns: Boolean!
removePaymentMethod
removePaymentMethod(id: ID!): Boolean!Remove a payment method Requires: billing:write permission
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: Boolean!
requestDomainVerification
requestDomainVerification(input: RequestDomainVerificationInput!): DomainVerification!Mint an R5 domain-ownership challenge for the registrable-domain APEX of the input domain. Returns the DNS-TXT record or role-email challenge material ONCE.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | RequestDomainVerificationInput! | | |
Returns: DomainVerification!
requestImpersonation
requestImpersonation(input: RequestImpersonationInput!): ImpersonationOp!Open an AP00009 impersonation op (status -> PENDING_APPROVAL). Kicks off the 4-eyes ceremony; does NOT mint a grant and accepts NO step-up token. Fail-closed until wired (ADR-359).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | RequestImpersonationInput! | | |
Returns: ImpersonationOp!
requestSubjectAccessExport
requestSubjectAccessExport(dsarId: ID!): SabExportReceiptRequest the signed Subject Access Bundle export (.dsar.zip, Art-15/20 — ExportSubjectAccessBundle; ENG-2998 seam 3). The console sends ONLY the dsarId: AP00005 derives the audit-chain slice server-side from the JWT-derived tenant scope. Admin-class write (dsarScopeWrite gate — a disclosure export is never an arbitrary-member action) + AP00005 enforces identity-proofing (fail-closed 4020) before ANY disclosure. An unknown / cross-tenant dsarId → null; not-proofed / an unpullable cross-service source → a client-actionable validation error; an unwired backend → OSY-EUCOMPLIANCE-NOT-WIRED. downloadUrl is an honest null on a transport with no native presigned GET — never a partial or fabricated bundle.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| dsarId | ID! | | |
Returns: SabExportReceipt
resendVerificationEmail
resendVerificationEmail(input: ResendVerificationEmailInput!): ResendVerificationEmailResult!Resend the verification email (ENG-664)
PUBLIC + enumeration-neutral: requests a fresh verification link for a
PENDING_VERIFICATION account. success is ALWAYS true — IAM never reveals
whether the address exists or was already verified. Rate limited per email +
per IP (the email-sending endpoint is an email-bombing vector).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | ResendVerificationEmailInput! | | |
Returns: ResendVerificationEmailResult!
retirePrivateEndpoint
retirePrivateEndpoint(id: ID!): PrivateEndpoint!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: PrivateEndpoint!
revokeAllSessions
revokeAllSessions: Boolean!Returns: Boolean!
revokeApiKey
revokeApiKey(id: ID!): Boolean!Soft-delete a key. Idempotent.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: Boolean!
revokeContentBoundEnablement
revokeContentBoundEnablement(input: RevokeContentBoundEnablementInput!): ContentBoundEnablement!Revoke an enablement (-> REVOKED).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | RevokeContentBoundEnablementInput! | | |
Returns: ContentBoundEnablement!
revokeImpersonation
revokeImpersonation(input: RevokeImpersonationInput!): ImpersonationRevokeReceipt!Revoke an impersonation op/grant. The authoritative revoke is at AP00009. Fail-closed until wired.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | RevokeImpersonationInput! | | |
Returns: ImpersonationRevokeReceipt!
revokeInvitation
revokeInvitation(invitationId: ID!): Boolean!Revoke a pending invitation in the caller's workspace (resolved from the JWT). Returns true on success.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| invitationId | ID! | | |
Returns: Boolean!
revokeOcnpLease
revokeOcnpLease(input: RevokeOcnpLeaseInput!): RevokeOcnpLeaseResult!Revoke one or more OCNP leases through the SINGLE ENG-2490 revoke authority (revoker.Publish — the SAME wire the Admit gate's cross-replica invalidation rides). The workspace is JWT-derived (NEVER input) and stamped onto the RevokeEvent.Workspace. Propagation is observable via the returned subscriberCount. FAIL-CLOSED: an unauthenticated caller is rejected before the revoker is touched; a Publish transport error surfaces as an error (the revoke did NOT propagate), never a fabricated success.
Returns OSY-OCNP-NOT-WIRED until the OCNP gate is enabled and the ENG-2490 revoker is wired (dev path).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | RevokeOcnpLeaseInput! | | |
Returns: RevokeOcnpLeaseResult!
revokeSession
revokeSession(sessionId: ID!): Boolean!Session management
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| sessionId | ID! | | |
Returns: Boolean!
revokeVirtualKey
revokeVirtualKey(vkid: ID!): RevokeVirtualKeyPayload!Revoke a virtual key (durable floor + edge mirror).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| vkid | ID! | | |
Returns: RevokeVirtualKeyPayload!
rollbackBundle
rollbackBundle(scope: ScopeInput!, toBundleVersion: Int!): PublishReceipt!Revert the active bundle at the JWT-derived scope to an earlier version. Requires the same admin role.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| scope | ScopeInput! | | |
| toBundleVersion | Int! | | |
Returns: PublishReceipt!
rollbackDeployment
rollbackDeployment(input: RollbackDeploymentInput!): PromptDeployment!Sign + atomically insert a prompt.deployment.v1 pointer claim re-pointing the environment BACK to targetCid (intent pinned to "rollback"; priorCid required). JWT-derived workspace; returns the REAL inserted pointer — or an error (NO STUBS).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | RollbackDeploymentInput! | | |
Returns: PromptDeployment!
rotateApiKey
rotateApiKey(id: ID!): CreateApiKeyResult!Atomically revoke id and mint a replacement. Returns the new plaintext.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: CreateApiKeyResult!
rotateVirtualKey
rotateVirtualKey(input: RotateVirtualKeyInput!): RotateVirtualKeyPayload!Re-issue the grant. alias is present (plaintext-once) ONLY when rotateAlias=true.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | RotateVirtualKeyInput! | | |
Returns: RotateVirtualKeyPayload!
sendTestEvent
sendTestEvent(id: ID!): SendTestEventResult!Mint a test event through the REAL accept+dispatch path — a genuine signed
POST reaches the registered URL (requires the subscription to be ENABLED).
This is a real delivery, not a simulation (NO STUBS).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: SendTestEventResult!
setEventSubscriptionEnabled
setEventSubscriptionEnabled(id: ID!, enabled: Boolean!): EventSubscription!Enable or disable a subscription of the caller's org. The registry never deletes — disable is the off switch (delivery history stays auditable).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| enabled | Boolean! | | |
| id | ID! | | |
Returns: EventSubscription!
setOcarTrustConfig
setOcarTrustConfig(input: SetOcarTrustConfigInput!): OcarTrustConfig!SET the workspace OCAR allowlist + threshold (CAS on expectedVersion). A STRENGTHENING change applies immediately; a WEAKENING change lands pending=true awaiting a 2nd-admin promote. WORKSPACE_ADMIN + CONFIGURE_OCAR_TRUST_MODE step-up (binding re-derived from input). Workspace JWT-derived (NEVER input). OSY-OCAR-CONFIG-NOT-WIRED until VIR_SERVICE_ADDR is set.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | SetOcarTrustConfigInput! | | |
Returns: OcarTrustConfig!
setWarehouseDestinationEnabled
setWarehouseDestinationEnabled(destinationId: ID!, enabled: Boolean!): WarehouseDestination!Flip a destination's delivery-enabled flag (SetWarehouseDestinationEnabled). ADMIN-CLASS write (gated on warehouseScopeAdmin). An unknown / cross-tenant id → OSY-WAREHOUSE not-found (null-safe error). Fails closed to OSY-WAREHOUSE-NOT-WIRED when unwired.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| destinationId | ID! | | |
| enabled | Boolean! | | |
Returns: WarehouseDestination!
setWorkspaceDefaultProvider
setWorkspaceDefaultProvider(workspaceId: ID!, model: String!, provider: String!): WorkspaceDefaultProvider!Declare provider as the workspace default for model. declaredBy is
derived server-side from the re-verified user JWT (never an input). An
ineligible provider is rejected with OSY-VALID-4041 verbatim; an unknown
model with OSY-VALID-4042. Requires: osyra:billing:*:write.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| model | String! | | |
| provider | String! | | |
| workspaceId | ID! | | |
Returns: WorkspaceDefaultProvider!
signPromptVersion
signPromptVersion(input: SignPromptVersionInput!): PromptTemplateVersion!Sign + atomically insert a NEW immutable prompt.template.v1 version claim in the caller's JWT-derived workspace. Returns the REAL inserted claim projection (claimId / signer / ts from OME; contentHash = the render-preimage hash the edge computed) — or an error (NO STUBS). Engine is pinned server-side.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | SignPromptVersionInput! | | |
Returns: PromptTemplateVersion!
signUp
signUp(input: SignUpInput!): SignUpResult!Self-service signup Creates organization, workspace, and user atomically Rate limited: 5 per IP per hour
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | SignUpInput! | | |
Returns: SignUpResult!
submitContactSalesRequest
submitContactSalesRequest(input: SubmitContactSalesRequestInput!): SubmitContactSalesRequestResult!Capture one real hand-raise in IAM's signed-WORM funnel and trigger the configured founder/requester notifications. Rate limited to 5/user/minute in shared Redis at Edge. IAM is the sole event owner: Edge emits no second CONTACT_SALES event.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | SubmitContactSalesRequestInput! | | |
Returns: SubmitContactSalesRequestResult!
submitEvalRun
submitEvalRun(input: SubmitEvalRunInput!): EvalReceipt!Submit a run over a committed eval suite → mint a re-decidable oev.v1 eval receipt (AP00016 SubmitEvalRun).
A MUTATION (it mints a signed receipt). Requires authentication; the workspace is JWT-derived (NEVER from
input) and bound into the signed body + envelope. Fail-closed OSY-EVAL-NOT-WIRED when the verifier / OEV
anchor is unwired; a coded reason on an arity / missing-model / empty-suite reject (nothing signed).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | SubmitEvalRunInput! | | |
Returns: EvalReceipt!
submitTraceFeedback
submitTraceFeedback(input: SubmitTraceFeedbackInput!): SubmitTraceFeedbackPayload!Package a signed trace-feedback annotation → AP00016 EmitEATReceipt(kind="otfa.v1"). A MUTATION (it mints a signed receipt + burns a single-use EAT nonce). Requires authentication; ws + author_id are JWT-derived (NEVER from input). The edge computes annotation_version = latest(ws,subject,author)+1, enforces the mint-time subject-existence gate (reject subject ∉ ws attested index), and redacts+hashes any comment. Fail-closed (a coded OSY-OTFA reason, nothing signed) on a malformed subject / unknown subject / unauthorized author; a sanitized REJECT when the verifier is unreachable/unwired.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | SubmitTraceFeedbackInput! | | |
Returns: SubmitTraceFeedbackPayload!
testPrivateEndpointReachability
testPrivateEndpointReachability(id: ID!): ReachabilityReport!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
Returns: ReachabilityReport!
transferOrgOwnership
transferOrgOwnership(input: TransferOrgOwnershipInput!): OrgOwnershipTransferResult!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | TransferOrgOwnershipInput! | | |
Returns: OrgOwnershipTransferResult!
transferWorkspaceOwnership
transferWorkspaceOwnership(input: TransferWorkspaceOwnershipInput!): WorkspaceOwnershipTransferResult!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | TransferWorkspaceOwnershipInput! | | |
Returns: WorkspaceOwnershipTransferResult!
updateBillingSubscription
updateBillingSubscription(input: UpdateSubscriptionInput!): BillingSubscription!Update subscription plan Requires: billing:admin permission
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | UpdateSubscriptionInput! | | |
Returns: BillingSubscription!
updateBudget
updateBudget(id: ID!, usdCeilingCents: String, mode: BudgetMode, alertThresholdPcts: [Int!], enabled: Boolean): Budget!Update a budget's mutable config. Only the provided fields change (the edge merges over the current budget); scope + period-kind are immutable. Requires: osyra:billing:*:write.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| alertThresholdPcts | [Int!] | | |
| enabled | Boolean | | |
| id | ID! | | |
| mode | BudgetMode | | |
| usdCeilingCents | String | | |
Returns: Budget!
updateMemberRole
updateMemberRole(input: UpdateMemberRoleInput!): Member!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | UpdateMemberRoleInput! | | |
Returns: Member!
updateOrganization
updateOrganization(id: ID!, input: UpdateOrganizationInput!): Organization!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
| input | UpdateOrganizationInput! | | |
Returns: Organization!
updatePaymentMethod
updatePaymentMethod(input: UpdatePaymentMethodInput!): PaymentMethod!Update default payment method Requires: billing:write permission
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | UpdatePaymentMethodInput! | | |
Returns: PaymentMethod!
updatePolicy
updatePolicy(scope: ScopeInput!, policyId: String!, source: String!): Policy!Replace an existing policy's source by id. Requires the same admin role as createPolicy.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| policyId | String! | | |
| scope | ScopeInput! | | |
| source | String! | | |
Returns: Policy!
updatePrivateEndpoint
updatePrivateEndpoint(input: UpdatePrivateEndpointInput!): PrivateEndpoint!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | UpdatePrivateEndpointInput! | | |
Returns: PrivateEndpoint!
updateProfile
updateProfile(input: UpdateProfileInput!): User!Profile management
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | UpdateProfileInput! | | |
Returns: User!
updateSignupProfile
updateSignupProfile(input: UpdateSignupProfileInput!): SignupProfile!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | UpdateSignupProfileInput! | | |
Returns: SignupProfile!
updateSsoConfig
updateSsoConfig(entityId: String!, ssoUrl: String!, certificatePem: String!, defaultRole: String!, groupMappings: [SsoGroupMappingInput!]!): SsoConfig!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| certificatePem | String! | | |
| defaultRole | String! | | |
| entityId | String! | | |
| groupMappings | [SsoGroupMappingInput!]! | | |
| ssoUrl | String! | | |
Returns: SsoConfig!
updateWorkspace
updateWorkspace(id: ID!, input: UpdateWorkspaceInput!): Workspace!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| id | ID! | | |
| input | UpdateWorkspaceInput! | | |
Returns: Workspace!
verifyEvalReceipt
verifyEvalReceipt(input: VerifyEvalReceiptInput!): EvalReceiptVerdict!Offline-re-decide a minted eval receipt (AP00016 VerifyEnvelope over oev.v1). A MUTATION because the EAT nonce is burned single-use at the envelope layer. Requires authentication; the workspace is JWT-derived and AP00016 re-checks it == the receipt's SIGNED ws (cross-tenant → REJECT). Reproduces the GREEN verdict for an honest receipt; renders a tampered / suite-swapped receipt as the fail-closed RED state.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | VerifyEvalReceiptInput! | | |
Returns: EvalReceiptVerdict!
verifyInferenceReceipt
verifyInferenceReceipt(input: InferenceReceiptInput!): InferenceReceiptVerdict!Re-decide a standalone inference OIR receipt server-side (AP00016 VerifyOir) and durably persist it on accept. A MUTATION (not a query) because AP00016 durably persists the accepted receipt for the workspace receipt list. Requires authentication; the workspace is JWT-derived (NEVER from input) and AP00016 re-checks it == the OIR's SIGNED ws. Fail-closed OSY-OIR-NOT-WIRED when the verifier/anchors are unwired.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | InferenceReceiptInput! | | |
Returns: InferenceReceiptVerdict!
verifyMergeReceipt
verifyMergeReceipt(input: VerifyMergeReceiptInput!): VerifyMergeReceiptPayload!Offline re-decide an EAT-hosted Merge Receipt. valid=false + reason/errorCode
is DATA (not a GraphQL error). The relying party pins the signer pubkey.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | VerifyMergeReceiptInput! | | |
Returns: VerifyMergeReceiptPayload!
verifyMfa
verifyMfa(input: VerifyMfaInput!): Boolean!Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | VerifyMfaInput! | | |
Returns: Boolean!
verifyOadrAdmission
verifyOadrAdmission(input: OadrAdmissionInput!): OadrAdmissionVerdict!Re-verify a signed OADR (oadr.v1) admission envelope as the supply-chain compliance gate.
The workspace is JWT-derived (NEVER input) and stamped onto the AP00016 VerifyEnvelope
request; AP00016 rejects unless it equals the signed workspace claim (cross-tenant →
accepted=false). FAIL-CLOSED: the verifier being unreachable surfaces as an error; a verify
failure surfaces as accepted=false with the OADR_* reason — never a fabricated green verdict.
It is modelled as a mutation (not a query) because VerifyEnvelope burns the envelope's single-use eat_nonce within the workspace — it is NOT a side-effect-free read.
Returns OSY-OADR-NOT-WIRED until VIR_SERVICE_ADDR is configured (dev path).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | OadrAdmissionInput! | | |
Returns: OadrAdmissionVerdict!
verifyOcarTrustMode
verifyOcarTrustMode(input: OcarVerificationInput!): OcarVerificationVerdict!Re-verify a signed host EAT envelope + its detached OCAR co-sign bundle in the relying-party OCAR trust-mode. Workspace JWT-derived (NEVER input). Modelled as a mutation because VerifyEnvelope burns the envelope's single-use nonce. Returns OSY-OCAR-NOT-WIRED until VIR_SERVICE_ADDR is set.
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | OcarVerificationInput! | | |
Returns: OcarVerificationVerdict!
verifyRetrieval
verifyRetrieval(input: VerifyRetrievalInput!): VerifyRetrievalResult!Re-decide an osyidx verifiable-retrieval response server-side, scoped to the caller's workspace (derived from the JWT, never from input — defense-in-depth per ENG-777 SEC-H1). Returns the structured verdict as DATA: a false verdict (rollback / forged manifest / per-hit leg failure) is rendered faithfully, never reclassified as an error. Returns OSY-VERIFY-RETRIEVAL-NOT-WIRED until OME_ENABLED and an OMEClient is configured (dev path).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | VerifyRetrievalInput! | | |
Returns: VerifyRetrievalResult!
verifyTokenCapital
verifyTokenCapital(input: OtccVerifyInput!): OtccVerification!Re-verify a signed OTCC (otcc.v1) token-capital certificate. The workspace
is JWT-derived (NEVER input) and stamped onto the AP00011-ome
VerifyTokenCapital request. FAIL-CLOSED: an unreachable verifier surfaces as
an error (REJECT), never a green verdict; a verify failure surfaces as
accepted=false with the OSY-OTCC-89xx reason — never a fabricated Δ.
🛑 CLAIM-DISCIPLINE: the returned verdict carries attributable +
nonAttributableReason SEPARATE from accepted. The console MUST surface
SLICE_SELF_DECLARED / DEGENERATE_ABLATION as explicit non-attributable states
— never imply "the model is better".
Returns OSY-OTCC-NOT-WIRED until the AP00011-ome VerifyTokenCapital RPC (ENG-2524) is published and an OMEClient is wired (current state).
Arguments
| Name | Type | Default | Description |
| --- | --- | --- | --- |
| input | OtccVerifyInput! | | |
Returns: OtccVerification!